Sean P. Murphy | The Fine Print

Bank of America less than charitable to charity that says it was hacked

Steve Kallaugher posed at his home in Leeds., Mass.
Steve Kallaugher posed at his home in Leeds., Mass. Nic Antaya for the Boston Globe

A slightly panicked Steve Kallaugher called Bank of America last month after $18,542 disappeared from a checking account he uses to operate a small charity that feeds and clothes orphans in Africa.

Kallaugher is a former advertising executive who, at age 53, decided to join the Peace Corps and devote the rest of his life to charity. He told the bank representative on the phone that he suspected someone had hacked into his account while posing as him and made a dozen fraudulent withdrawals over three days in July.

He said he expected Bank of America to quickly apologize for a lapse in security and cover the loss.


“I told the bank we’re a little organization that takes care of orphans and we really can’t afford to lose this money,” Kallaugher, 67, of Northampton, said.

But the bank, one of the largest and richest in the world, refused to cover the loss, offering only baffling reasons for its decision.

The withdrawals were made via a payroll service that Bank of America offers its checking account customers, according to descriptions of the withdrawals posted on the account. But Kallaugher said he assumes the bank has records showing he never used the fee-based service, which he said he didn’t know existed until he noticed references to it when the fraudulent withdrawals were made.

“I never signed up for it, I never paid fees for it, I never received any statements regarding it,” Kallaugher said. “I know nothing about it. ”

Michael Lipton, a retired business executive who has served on the charity’s nine-member board for about 10 years, said he believes someone impersonating Kallaugher hacked into the account, set up payroll services, and arranged for phony payments.

He said Bank of America should have e-mailed Kallaugher some kind of confirmation of his new payroll service, if Kallaugher had actually opted to use those services, as a safeguard against a security breach.


“If Steve got a notice, he would have shut it down in a heartbeat,” Lipton said. “But the bank didn’t do that. And that makes the bank responsible, in my view.”

Kallaugher founded the Young Heroes Foundation in 2006 after more than two years in Swaziland, a tiny, impoverished country with some of the highest rates of HIV/AIDS infection in the world.

The foundation has raised more than $1 million for direct support of children who have lost one or both parents to HIV/AIDS. Kallaugher said the charity is mainly a conduit for grant money from major donors such as the Los Angeles-based AIDS Healthcare Foundation and the Community Foundation of Ireland. Kallaugher said that this year he decided to stop taking a salary of about $18,000 a year from the charity and now lives on Social Security and savings.

In addition to writing grant proposals, Kallaugher raises funds by auctioning donated art and leading an annual bike ride through Swaziland (population 1.4 million, about the size of Massachusetts).

The Bank of America representative Kallaugher first reached by phone on Aug. 8 told him to file a claim, which he did, checking off the box saying “My account/identity has been compromised.”

The rep said it could take 15 to 17 days to be resolved.

Eighteen days later, having heard nothing from the bank, and with the money still missing, Kallaugher called again.


This time, a different bank representative said the claim had been denied. Why? The bank rep told Kallaugher that whoever made the withdrawals had apparently somehow cited the “proper name” of the Young Heroes Foundation. Kallaugher said another Bank of America representative, in a follow-up conversation, confirmed that his claim was denied because the party making the debits had used the charity’s name.

Of course, the name of the charity, and other pertinent information, such as its federal tax ID number, are publicly available.

Kallaugher immediately demanded that the bank reopen the claim. And, somewhat to his surprise, the bank rep agreed, saying he would receive a letter confirming the bank’s reconsideration in two or three days.

But the letter that arrived days later only added to the confusion. It informed Kallaugher the bank had closed his claim, and never mentioned reconsideration.

In the letter, the bank focused solely on two credits made to Kallaugher’s account by unnamed “merchants.”

The unauthorized transactions on the account included 13 debits ranging from 2 cents to $4,151. The two unauthorized deposits made to the account at about the same time were for 2 cents and 29 cents.

Obviously, 31 cents in credits does not offset $18,542 in debits. But that was the apparent logic behind the Bank of America’s denial of Kallaugher’s claim.

“We are pleased to inform you that we found one or more merchant credits posted to your account for $0.02 and $0.29,” the letter reads. (What merchants? The bank doesn’t say.)


“Because the merchant has credited your account, no further credit was issued,” it says. “We now consider this dispute resolved.”

Bank of America declined to talk to me except to say the bank has decided it will once again look at Kallaugher’s claim.

Let’s hope there is a better result for the orphans of Swaziland.

Steve Kallaugher held a photo of some of the orphans his charity has supported.
Steve Kallaugher held a photo of some of the orphans his charity has supported. Nic Antaya for the Boston Globe

Sean P. Murphy can be reached at smurphy@globe.com. Follow him on Twitter @spmurphyboston.